io.github.codespar/mcp-clearsale
NPM · @CODESPAR/MCP-CLEARSALE · SCANNED AUG 4
MCP server for ClearSale — Brazilian fraud prevention, order risk scoring, device fingerprinting
Available components
How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score →
Supply Chain Security86
- No malware found by supply-chain analysis.Pass
- Only part of the dependency tree could be resolved (94 of 98), so this covers what we could see, not the whole tree.Partial
- No install/post-install scripts declared.Pass
- Only part of the dependency tree could be resolved (94 of 98), so this covers what we could see, not the whole tree. View diagnostics → Partial
Provenance & Transparency45
- Source repository is publicly reachable at the declared URL. View diagnostics → Pass
- Provenance check failed: no build-provenance attestation is published. See how to fix → View diagnostics → Fail
- Clear OSI-approved license (MIT).Pass
- Actively maintained (last published 42 days ago).Pass
- Disclosure check failed: no security disclosure policy was found in the source repository. See how to fix → Fail
Schema Quality & AI Usability74
- AI-judged instruction clarity (excellent).Pass
- Context-footprint check failed: tool/resource definitions use about 2135 tokens (~118/item across 18 items; 18 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management30
- Stability observed for 9 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage100
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 100% of tool parameters carry a description.Pass
Capabilities100
- Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
Add this component to your MCP client. Where a client-specific snippet is available, pick your client below and copy it straight into your config; otherwise use the connection detail shown.
npm · @codespar/mcp-clearsale
claude mcp add codespar-mcp-clearsale -- npx -y @codespar/mcp-clearsale
codex mcp add codespar-mcp-clearsale -- npx -y @codespar/mcp-clearsale
{
"$schema": "https://opencode.ai/config.json",
"mcp": {
"codespar-mcp-clearsale": {
"type": "local",
"command": [
"npx",
"-y",
"@codespar/mcp-clearsale"
],
"enabled": true
}
}
} openclaw mcp add codespar-mcp-clearsale --command npx --arg -y --arg @codespar/mcp-clearsale
mcp_servers:
codespar-mcp-clearsale:
command: "npx"
args: ["-y", "@codespar/mcp-clearsale"] {
"mcpServers": {
"codespar-mcp-clearsale": {
"command": "npx",
"args": [
"-y",
"@codespar/mcp-clearsale"
]
}
}
} Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 3 Aug 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 23 to 27. That category is still filling its 30-day observation window: 7 days of observed history at the previous scan, 8 at this one. The score rises as the window fills, whether or not the server changes.
- 2 Aug 26 +48
- Provenance: unverified → fail ▼ security
- Install scripts: unverified → pass ▲ security
- Known CVEs: unverified → partial ▲ security
- Schema quality: unverified → excellent ▲ functional
- License: unverified → pass ▲ functional
- Dependency health: unverified → partial ▲ functional
- Maintenance: unverified → pass ▲ functional
- MCP protocol: unverified → pass ▲ functional
- Stability: unverified → 0.23 ▲ functional
- Tool coverage: unverified → 100 ▲ functional
- Licence: MIT functional
- 1 Aug 26 0
- Malware scan: unverified → pass ▲ security
- Tool coverage: 100 → unverified ▼ functional
- 31 Jul 26 −4
- We updated how we score, so this day's move reflects our rubric, not a change to the server See what changed → functional
- 30 Jul 26 −21
- Tool coverage: 100 → unverified ▼ functional
- First check of Schema quality: unverified functional
- 27 Jul 26 45
First indexed and scored.
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 4 Aug 2026 · Analysed npm/@codespar/[email protected]
Provenance none
Ecosystem: npm · Outcome: none
Dependencies 94 packages
94 packages in the resolved dependency tree · 94 deprecated · 29 stale.
The dependency tree was only partially resolved, so these counts may be incomplete.
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability.
create_case ~125
Open a fraud investigation case (e.g. for a suspicious cluster of orders or a confirmed fraud ring). Cases group orders, evidence, and analyst notes.
| Name | Type | Req | Description |
|---|---|---|---|
| assignee | string | — | Analyst username or id to assign the case to |
| description | string | — | Detailed description of the suspected fraud pattern |
| order_ids | array | — | Order ids to attach to the case |
| priority | string | — | Case priority |
| tags | array | — | Tags for filtering (e.g. ring, takeover, friendly_fraud) |
| title | string | yes | Short case title |
No output schema declared.
No examples provided.
create_chargeback_notification ~111
Report a confirmed chargeback back to ClearSale. Critical for model tuning: unreported chargebacks degrade future decision quality for similar buyers.
| Name | Type | Req | Description |
|---|---|---|---|
| amount | number | yes | Chargeback amount in BRL (major units) |
| chargeback_date | string | yes | Date the chargeback was confirmed (ISO-8601 date) |
| chargeback_reason | string | yes | Issuer / acquirer reason code or free-text reason |
| order_id | string | yes | Merchant-side order id the chargeback applies to |
No output schema declared.
No examples provided.
create_device_fingerprint_session ~110
Start a device fingerprint session. Returns a session_token the client embeds via ClearSale's browser JS SDK to capture device characteristics. Pass the same session_id into send_order_for_analysis to link the device to the order.
| Name | Type | Req | Description |
|---|---|---|---|
| ip | string | yes | Client IP observed at session start |
| session_id | string | yes | Merchant-generated session id (UUID recommended). Reuse this value in send_order_for_analysis.session_id. |
| user_agent | string | yes | Browser User-Agent header observed at session start |
No output schema declared.
No examples provided.
get_device_fingerprint ~53
Retrieve captured device characteristics for a fingerprint session (OS, browser, timezone, canvas/WebGL hash, suspected emulator, etc).
| Name | Type | Req | Description |
|---|---|---|---|
| session_id | string | yes | session_id originally passed to create_device_fingerprint_session |
No output schema declared.
No examples provided.
get_order_analysis ~56
Retrieve the current analysis state of an order previously sent to ClearSale. Useful when the initial response was EM_ANALISE and the decision is made asynchronously.
| Name | Type | Req | Description |
|---|---|---|---|
| id | string | yes | Merchant-side order id used in send_order_for_analysis |
No output schema declared.
No examples provided.
get_order_score ~50
Fetch only the fraud score (numeric 0-100) for an order. Lighter than get_order_analysis when the full decision envelope isn't needed.
| Name | Type | Req | Description |
|---|---|---|---|
| id | string | yes | Merchant-side order id |
No output schema declared.
No examples provided.
get_score_by_contact ~87
Look up the risk score for a contact identifier (email or phone). Use for account-takeover screening at login or password reset.
| Name | Type | Req | Description |
|---|---|---|---|
| string | — | Email address to score. One of email or phone is required. | |
| phone | string | — | Phone number in E.164 (e.g. +5511999998888). One of email or phone is required. |
No output schema declared.
No examples provided.
get_score_by_document ~80
Look up the risk score and historical signals associated with a Brazilian document (CPF or CNPJ). Use for pre-checkout screening or onboarding.
| Name | Type | Req | Description |
|---|---|---|---|
| document | string | yes | CPF (11 digits) or CNPJ (14 digits). Punctuation is stripped server-side. |
| document_type | string | — | Document type. If omitted, inferred from length. |
No output schema declared.
No examples provided.
issue_challenge ~117
Issue an authentication challenge (OTP via SMS/email or KBA question) to a buyer. Use as a step-up after EM_ANALISE or for high-risk flows.
| Name | Type | Req | Description |
|---|---|---|---|
| channel | string | yes | Delivery channel for the challenge |
| destination | string | — | Phone (E.164) or email — required for sms/email/whatsapp |
| locale | string | — | BCP-47 locale for the challenge copy (default pt-BR) |
| order_id | string | — | Order id the challenge is associated with (optional but recommended) |
No output schema declared.
No examples provided.
list_orders ~136
List orders submitted to ClearSale with optional filters. Use for dashboards, reconciliation, and reviewing pending manual decisions.
| Name | Type | Req | Description |
|---|---|---|---|
| end_date | string | — | Inclusive upper bound, ISO-8601 date (YYYY-MM-DD) |
| filters | object | — | Additional pass-through filters serialized as query params |
| page | number | — | Page number (starts at 1) |
| per_page | number | — | Page size |
| start_date | string | — | Inclusive lower bound, ISO-8601 date (YYYY-MM-DD) |
| status | string | — | Filter by decision status (APROVADO, REPROVADO, EM_ANALISE) |
No output schema declared.
No examples provided.
resolve_manual_review ~107
Manually resolve an order currently in EM_ANALISE by approving or declining it. Use when an analyst overrides ClearSale's pending decision. The decision is fed back into the model.
| Name | Type | Req | Description |
|---|---|---|---|
| analyst | string | — | Analyst username or id who made the decision (recommended for audit) |
| decision | string | yes | Analyst's manual decision |
| id | string | yes | Merchant-side order id of the order in EM_ANALISE |
| reason | string | — | Free-text rationale for the manual decision |
No output schema declared.
No examples provided.
send_order_for_analysis ~349
Submit an order to ClearSale for fraud analysis. Returns a score (0-100) and a decision (APROVADO / REPROVADO / EM_ANALISE). Include as much signal as possible — billing + shipping, IP, device, items, and payment — to improve the decision.
| Name | Type | Req | Description |
|---|---|---|---|
| customer_billing | object | yes | Billing customer: name, document (CPF/CNPJ), birth_date, phone, and address fields (street, number, city, state, zip_code). |
| customer_shipping | object | yes | Shipping customer: name, document, phone, and address fields. Same schema as customer_billing. |
| date | string | yes | Order creation timestamp in ISO-8601 (e.g. 2026-04-21T14:32:00Z) |
| string | yes | Buyer's email address | |
| id | string | yes | Merchant-side order id (must be unique and stable — used to correlate future status updates and chargebacks) |
| ip | string | yes | Buyer's IP address at order time (IPv4 or IPv6) |
| items | array | yes | Line items: each with sku, name, category, quantity, unit_price. |
| payment | array | yes | One or more payment methods used on this order (card, boleto, pix). Card details MUST be tokenized — never pass a raw PAN. |
| session_id | string | — | Optional device fingerprint session_id from create_device_fingerprint_session. Dramatically improves decision quality. |
| total_items | number | yes | Number of items in the order |
| total_order | number | yes | Total order amount in BRL (major units, e.g. 199.90) |
No output schema declared.
No examples provided.
track_behavior_event ~158
Log a behavior signal (page view, login, signup, custom event) tied to a fingerprint session. Behavior data sharpens decisions on subsequent send_order_for_analysis calls.
| Name | Type | Req | Description |
|---|---|---|---|
| event_name | string | — | Free-form event name (required when event_type=custom) |
| event_type | string | yes | Type of behavior event |
| properties | object | — | Arbitrary key/value properties attached to the event |
| session_id | string | yes | Fingerprint session_id to attach the event to |
| timestamp | string | — | Event timestamp in ISO-8601. Defaults to server receive time. |
| url | string | — | Page URL for page_view events |
| user_id | string | — | Authenticated user id, if known at event time |
No output schema declared.
No examples provided.
update_case ~113
Update an existing fraud investigation case — change status, add notes, reassign, or attach more orders.
| Name | Type | Req | Description |
|---|---|---|---|
| add_order_ids | array | — | Order ids to attach to the case |
| assignee | string | — | Reassign the case to this analyst |
| case_id | string | yes | Case id returned by create_case |
| note | string | — | Append a free-text note to the case timeline |
| status | string | — | New case status |
| tags | array | — | Replace the case's tag list |
No output schema declared.
No examples provided.
update_order_status ~101
Notify ClearSale of the merchant's final decision on an order (APROVADO / CANCELADO / DEVOLVIDO). This feeds the ML model and is required for accurate future decisions on the same buyer.
| Name | Type | Req | Description |
|---|---|---|---|
| id | string | yes | Merchant-side order id |
| reason | string | — | Free-text reason for the status change (recommended for CANCELADO and DEVOLVIDO) |
| status | string | yes | Merchant's final decision for this order |
No output schema declared.
No examples provided.
validate_address ~126
KYC: validate a Brazilian postal address against the Correios database. Confirms zip_code → street/neighborhood/city/state and flags mismatches.
| Name | Type | Req | Description |
|---|---|---|---|
| city | string | — | City |
| complement | string | — | Apartment / unit / complement |
| neighborhood | string | — | Bairro |
| number | string | — | Street number |
| state | string | — | State (UF, 2-letter code) |
| street | string | — | Street / logradouro to cross-check against the CEP |
| zip_code | string | yes | CEP (8 digits). Punctuation is stripped server-side. |
No output schema declared.
No examples provided.
validate_challenge_response ~68
Verify a buyer's response to a challenge issued via issue_challenge. Returns whether the response is valid and how many attempts remain.
| Name | Type | Req | Description |
|---|---|---|---|
| challenge_id | string | yes | challenge_id returned by issue_challenge |
| response | string | yes | OTP code or KBA answer submitted by the buyer |
No output schema declared.
No examples provided.
validate_document ~121
KYC: validate a CPF or CNPJ against Receita Federal. Returns registration status (REGULAR / SUSPENSA / CANCELADA / NULA / PENDENTE) and, when authorized, holder name and birth date.
| Name | Type | Req | Description |
|---|---|---|---|
| birth_date | string | — | Holder's birth date (YYYY-MM-DD). Required by Receita for CPF cross-checks. |
| document | string | yes | CPF (11 digits) or CNPJ (14 digits). Punctuation is stripped server-side. |
| document_type | string | — | Document type. If omitted, inferred from length. |
No output schema declared.
No examples provided.